S. Kane, E. Liberman, N. Black

The automotive safety community is remembering David James Biss  as a researcher, safety advocate, a crashworthiness and occupant protection expert, whose analyses made significant contributions to outing defective designs, and a kind and gentle man. Biss passed away on Feb. 15, at age 79, of  complications from multiple myeloma.

Over a wide-ranging, half-century career, Biss furthered automotive safety in many ways, and never lost his interest in improving occupant protection. He was well-known for his seminal work in the area of seatbelts. For example, in the mid-1970s automakers added “window-shade” devices to seatbelts to reduce the webbing tension as a comfort feature, Biss authored technical papers and was a public voice in the media about these designs, which induced slack into the belt webbing, significantly reducing restraint effectiveness and resulting in serious injuries and deaths. He also a key figure in identifying the hazards of passive seatbelt designs that automakers installed as an alternative to airbags and as a means to meet the National Highway Traffic Safety Administration’s policy objectives for automatically protecting occupants.

“He was a consummate professional and the go-to expert for seat belts. Period. No doubt about it – everything—passive belts, retractors geometry of belts, the Forgotten Child,” says Robert M. N. Palmer, a Springfield, Mo. attorney and longtime colleague who retained him in more than 60 cases, and close friend. “He was on the forefront.”

In 1968, Biss earned a Bachelor of Science in Mechanical Engineering, and a Master of Science in Civil Engineering in 1971. In 1980, Biss also earned a B.S. in journalism at the University of Maryland.

He began his career in 1972 at the Cornell Aeronautical Lab in Buffalo, NY. In 1976, he joined NHTSA as a researcher in support of rulemaking initiatives. During his tenure at the federal agency, Biss became Technical Manager of Research Projects and Senior Physical Scientist. While at NHTSA, he conducted or oversaw numerous in-house and contracted research projects on crashworthiness, particularly in areas of occupant protection, occupant packaging, padding, structures, air cushion and belt restraints. He also analyzed crash and injury data.

In 1982, he opened his consulting practice Automotive Safety Analysis Corporation. One of his first projects involved conducting an in-depth analysis of vehicles tested in NHTSA’s NCAP  35 mph barrier test for Volvo of America Corp. Volvo was interested in understanding the interaction of structural deformation and restraint systems, and how it impacted the vehicle’s ability to protect occupants.

The following year, he worked for Volvo in Gothenburg, Sweden, as a resident research engineer in their Automotive Safety Advanced Engineering group. While there, he established computer-based analytical techniques to design and evaluate the performance of automotive safety systems, including occupant restraints, and trained Volvo engineers in how to use them in the design of air cushion restraint systems. He also analyzed Volvo’s on-site library of crash test evaluation data to establish safety performance improvements, and to recommend hardware design changes to improve the performance of both existing and future car models. While in Gothenburg he formed a friendship with Volvo engineer Nils Bohlin, the inventor of the three-point belt. They remained friends until Bohlin’s death in 2002.

David Biss Observing a 1975 Volvo with Frontal Impact Airbags Post-40 mph Barrier Impact Crash Test [U.S. DOT]

“David Biss was one of the automotive safety community champions, whose accomplishments in advancing better, research-based designs over his lifetime were significant,” says Sean Kane, president of Safety Research & Strategies, who worked with Biss on many defect issues. “And you can see their impact as occupant restraints evolved from devices that caused injuries and deaths to those that prevented them.”

Biss was also among three former NHTSA employees who challenged then-Administrator Diane Steed’s attempt to re-write Part 9 of the Code of Federal Regulations, which outlines the procedures governing the testimony of federal employees in legal proceedings. Steed proposed sweeping changes that would have brought former NHTSA employees under its authority and essentially precluded any testimony about NHTSA by its former employees. As Biss recalled for a story in The Safety Record (Former NHTSA Administrator Strickland Gets Part 9 Spanking), Steed wanted to shut down any former NHTSA employees challenging automakers’ preferred prima facie argument that if NHTSA approved something, or closed an investigation with no defect finding, or if a vehicle met the federal safety standard, a vehicle was therefore safe. Biss, former Administrator Joan Claybrook and safety advocate Ben Kelley, sought a declaratory judgment against the amendments, but the case was settled and the plaintiffs accepted a 1994 memo authored by former NHTSA counsel Stephen H. Kaplan which stated that ex-staffers can talk generally about the agency’s policies or specifically about issues in which they weren’t personally involved without seeking the agency’s permission, but opining on matters directly related to a former employee’s actions while on the job with the agency would require the agency’s approval.

Palmer used Biss in seven jury trials, with six plaintiffs’ victories. Biss was invaluable in advising Palmer which cases to take, and in educating him about the injuries and vehicle failures, Palmer says.

“He would constantly be sending me articles from SAE and he always insisted that I ‘kick the tin’ with him,” Palmer says. “A lot of the time, the lead lawyer doesn’t go to the vehicle inspection, but he would teach me why whatever we were looking at produced the injury or death. He made me a better lawyer.”

Biss also excelled at testifying at trial, because he could make engineering and crash dynamics understandable to the lay person. Palmer saw particular talent of Biss’s in the 1998 Dickerson case in Sugarland Texas, which involved the death of a young mother who was fatally injured in a frontal impact, while wearing a passive seatbelt. Martha Dickerson had just picked her three children up from school and was on her way home, when a drunk driver crossed the centerline and struck her vehicle head-on. While she and her children were all restrained, Martha Dickerson was only wearing the shoulder portion of the “passive” belt, which lulled occupants to believe they were fully protected, but required occupants to manually don a separate lap belt in order to prevent submarining under the shoulder strap. Everyone else walked away from the crash, including the other driver.

“I always try to debrief as many of the jurors as who will talk to me. And one juror told me that she decided the case because she thought he was the most brilliant person she had ever listened to,” he says. “I remember that distinctly. That stood out. Juries liked him. He was extremely prepared, very knowledgeable”

Biss’s work on the hazards associated with reclined seats was also pivotal in many cases that resulted in large plaintiffs’ verdicts. Palmer said Biss went to the UK, where he found Ford-authored research concluding seats should never be reclined more than 40 degrees – a direct contradiction to their position in litigation.

Biss’s litigation work was one of several significant factors pushing the industry to abandon unsafe airbag and seatbelt designs.

“We settled and got big verdicts in dozens and dozens of cases against Mazda, Ford and GM,” says Palmer. “We know that we put a lot of pressure on automakers.”

His colleagues and friends also spoke about his commitment to victims.

“David’s attention to detail brought clarity and authentication to every project, which helped many families who’ve had loved ones injured by defective products,” says Biomechanical Engineer Salena Zellers, a colleague and friend.  “Long after his work was done, he’d follow the progress of some of those he’d helped. The work David did helped bring change and improvement to automobile safety worldwide.”

Take the case of Margaret Romph – a Jefferson City, Mo. four-year-old, who was ejected from her Evenflo Express Booster seat in a January 2009 side-impact crash. Romph was secured in the booster in the right rear passenger seat, but the impact cracked the booster where it engaged the seatbelt webbing. She was thrown out of the restraint so violently, her neck and both her legs  fractured, leaving her a ventilator-dependent quadripelgic. Romph’s attorneys hired Biss to examine the restraint design and its failures.

Zellers recalls long nights and weekends working with Biss in preparation for his testimony. The case settled just before trial, but for years afterwards, Biss would visit the website, Miracles 4 Margaret, created by her mother Sherline, to follow Margaret’s progress. When she passed away in May 2019, David was “devastated,” says Zellers. “He continued to follow that child for eight years.”

Larry Wilson a mechanical engineer who specializes in crash reconstructions recalled meeting Biss around 2010, when he was testing Jeep Grand Cherokees and Ford Explorers in rear-impact crashes at the George Washington University’s FHWA/NHTSA National Crash Analysis Center with Ken Digges, the Center’s then Director of Biomechanics and Auto Safety Research, and Shaun Kildare, who studied under Digges, and is now the director of research for Advocates for Highway Safety. Wilson was interested in studying the crash pulses, Digges and Kildare in post-crash fires. Biss, who had an interest in seat failures in rear impacts, asked to join so he could to examine the crash and seat performance.

Wilson recalls Biss asking “Oh, you’re doing crash tests, can I get to just look at the seatback failure?” “That was something he was interested in. So, we were just a bunch of crash nerds getting together,” Wilson says. “He had a very keen mind, but, to me, what really stood out is just how nice of a person he was. For sure, he will be missed.”

A state court jury has awarded $9.7 million in damages to the family of Jose Chicas, a New Mexico man who died under the wheels of a rollaway 2015 BMW X5 nearly five years ago. The December 14 verdict came after an 11-day trial, in which the jury recognized that BMW was aware of the rollaway hazard and had designed a countermeasure in the X5 to prevent a driver from inadvertently putting the transmission into neutral, available just two model years earlier, but discarded it by the 2014 model year. Jeffrey Embry, of the Dallas firm Hossley & Embry, represented the Chicas family.

Rollaways – defined as unintended vehicle movement with no vehicle operator present – kill approximately 140 individuals each year and injure about 2,000 more annually. The causes range from mechanical or electronic malfunctions to simple human error. Increasingly, automakers are addressing the problem by automatically applying the Electric Parking Brake (EPB) or automatically shifting to Park on vehicles with electronic shift selectors or a combination of both in the event the driver exits and the gear selector is not Park. As vehicle systems increasingly move from discrete mechanical designs to integrated mechatronics, automakers have the systems in place that allow for feasible rollaway prevention features that can supplant less effective strategies like audible and visual alerts.   

But the public’s understanding of the nexus between product safety design and human factors is often lacking and mired in assigning the blame for product injuries and deaths solely to consumers who make mistakes – even though all humans make them. So, the jury’s decision is a significant advancement toward a general acknowledgement that automakers understand and expect drivers to make errors sometimes, that some errors can produce catastrophic outcomes, and that thoughtful design can prevent them.

The 2015 X5 is equipped with a monostable electronic gear selector, which BMW introduced in 2007. This type of shifter does not physically remain in the gear position selected, but rather returns to the center after the driver selection is made. In addition, the monostable gear selector doesn’t include Park in the shift selection sequence, instead Park is achieved via a button on the top of the gear selector lever. Pushing the gear selector lever forward with the service brake depressed places the transmission in Neutral, followed by Reverse.

2015 BMW X5: Monostable Gear Selector

BMW engineers anticipated that drivers, accustomed to traditional PRNDL gear selector arrangements, would occasionally exit the vehicle with the gear selector not in Park, so BMW implemented an automatic-park feature that would move the transmission into Park if the driver exited the vehicle without doing so. But if the driver wanted to intentionally leave the vehicle with the transmission in Neutral – to run the vehicle through a car wash, for example – the system also required that the key fob be inserted into a slot right next to the Start/Stop ignition button. This would disable the auto-park function, and affirm that the driver intended that gear position.

In the 2014 model year, BMW changed the design of its “car wash” mode. The slot was eliminated, and now, the automatic park function only engaged if the driver left the transmission in Drive or Reverse. The driver could exit with the vehicle in Neutral and the vehicle response would be a message on the dash and an interior audible alert. There was no exterior alarm, such as a horn honk.

On February 7, 2018, Jose Chicas, an employee at Ivy Paint & Body in Albuquerque, was securing vehicles into a fenced parking lot for the evening. Chicas had handled nearly 30 cars that day – including an X5 of the previous generation, with the monostable gear selector and an ignition slot design. As captured by security cameras, after moving the 2015 X5, Chicas appears to have attempted to put it into Park by pushing its Monostable gear selector forward, turned off the engine, exited the vehicle, with the fob in his pocket. As captured by security cameras, the vehicle began to roll rearward towards Chicas, who initially had his back to the vehicle as he was walking toward another vehicle, is seen turning around with his hands outstretched in an attempt to stop it but was knocked down and dragged under its wheels.

The Chicas case demonstrates how the combination of insufficient vehicle cues and human error — whether due to distraction, inattention, unfamiliar controls, or other factors — can lead to a rollaway that causes deaths and injuries.  Automakers know that most drivers don’t deliberately get out of an unsecured vehicle or attempt to exit a moving vehicle. Automakers also know that a vehicle not in Park may remain stationary for a period of time, due to topography, or engine status, for example.

Most importantly, automakers know that an unsecured vehicle is a safety hazard, which is why they program in visual and audible alerts if the driver attempts to exit with the transmission not in Park. These alerts are triggered by software taking information from the sensors that determine the vehicle status: vehicle speed the position of the gear selector, whether the engine is running, if the service and/or parking brake are applied, the driver’s seatbelt is buckled, , and the driver’s door is opened. In other words, vehicles are designed to know if a rollaway hazard is present, even if the driver isn’t aware of the danger. But, the industry has largely clung to the failed strategy of activating indistinguishable buzzers or chimes and visual texts that are not in the driver’s view as they exit, even after years of cumulative rollaway incidents that resulted in death and injuries. Rather than using that same hazard determination to activate the available hardware to prevent rollaway, such as an automatically applied EPB or an automatic-shift-to-Park on vehicles with E-shifters, automakers blame the driver.

Not-so-new views on human factors and causality models, such as Systems-Theoretic Accident Model and Processes /Systems-Theoretic Process Analysis (STAMP/STPA) consider the design of systems and the environment they are used in – and that operator error is a symptom, not the cause of an incident. For more than a decade automakers have begun to explore ways to incorporate STAMP/STPA into their design processes. As the number non-broken part rollaway incidents grow, they demonstrate the slowness of the industry to use these type of analyses to guide the implementation of better mitigation and preventive features.

“We tried this case as: BMW had the safety system in the prior generation X5 and they deleted it beginning with the 2014 X5 without any evidence that they did any engineering to justify deleting the safety measure,” Embry says. “In automotive engineering, you have to show your work and we talked about how they do that regularly and about Failure Mode and Effects Analyses, and that the jury will not see, because it doesn’t exist, any evidence that BMW properly engineered this vehicle before they decided to delete this important safety feature..”

Going into the trial, Embry was less than optimistic – Chicas bore some responsibility for the rollaway by failing to place the transmission in Park, and BMW had produced only limited documents in discovery. There were no settlement discussions; BMW’s counsel told Embry that his client wasn’t interested in settling for any amount of money.  

But, two weeks prior to the trial before First Judicial District Court Judge Matthew J. Wilson, Embry decided to simplify things for the jury by focusing on the removal of the safety feature in the X5’s original car wash mode. Embry emphasized that vehicles, like every other consumer product, are designed to address foreseeable human error.

“Human beings make errors, and we had in deposition testimony that BMW knew that people on occasion would mis-shift the shifter and the reason they had auto-park from Drive or Reverse was because they recognized that people could forget to press Park,” Embry said. “So why is it any different in Neutral?”

Embry also made the case that the 2015 X5’s visual alert and interior chime that activated when the vehicle was left in Neutral upon driver exit were insufficient, and did not even meet industry-set guidelines. In 2011, SAE issued voluntary design recommendation J-2948 Keyless Ignition Control Design, which calls for an exterior audible or visual alert if the driver exits with the fob while the vehicle is in accessory mode. That’s because drivers exiting a vehicle will not hear or see warnings that are only occurring inside the vehicle. (Chicas exited the X5 with the fob in his pocket, and since the transmission was in Neutral, the vehicle’s electrical system remained enabled, typically called Accessory. BMW calls it the “radio ready” state.)

“We argued that relying on a warning was not sufficient, and that BMW knew that warnings didn’t work. Human errors will only occur once in a while, but that’s exactly how human error is. This is a safety system you want to have in your car, because some day when you are distracted and your mind is not focused, whether you are the owner or if, like Mr. Chicas, you’ve never even driven one of these cars, you want to have that safety system,” Embry says.

The Santa Fe jury, an eclectic mix of individuals that included a stockbroker and a retired accident investigator for United Airlines, appeared to understand these arguments, he said. New Mexico rules allow the jury to ask questions.

“During some of the testimony, they were asking if there was an engineering document. Another question was: Did BMW conduct an FMEA before they deleted the safety feature?” Embry recalled.

Each day of the trial, BMW’s legal team, led by Bowman & Brooke’s Executive Managing Partner Thomas P. Branigan, as well as counsel from Germany, made a grand entrance, sweeping into three reserved parking spaces in front of the courthouse in black X5 vehicles with tinted windows. They brought in a fancy exemplar of the shifter and entire center console surrounding it, which could be rotated to face the jury. And yet, they seemed to be caught off-guard by the simplicity of the Plaintiffs’ argument, having prepared to defend the vehicle against a more sweeping attack on shift-by-wire systems, keyless ignition systems, NHTSA’s failure since 2011 to complete an amendment to FMVSS 114 Theft Prevention and Rollaway Protection, and the nuances of warning systems. BMW’s experts never even addressed X5’s earlier, safer, car wash mode design, Embry said.

BMW’s exemplar was impressive, compared to the component shifter Embry used at trial, but it ended up helping the Plaintiffs.

“Surrounding the shifter were 19 separate buttons. When I had an opportunity to cross-examine their expert, we counted up the buttons, and there were a couple that he didn’t know what they did,” Embry said.

The jury found that BMW was negligent and that the 2015 X5 presented an unreasonable risk of injury, which was the cause of Mr. Chicas’ death. It did not award punitive damages, and it split the fault, assigning 57.7 percent to the Plaintiff and 42.5 percent to BMW. This reduced the jury award to $4.2 million, but 10 percent pre-judgement interest added $1.5 million to the total. New Mexico also assesses 15 percent post-judgement interest, which amounts to $1,900 a day.

As soon as the jury was excused, BMW’s legal team abruptly left the courtroom.

“Normally, win lose or draw, lawyers shake hands and tell each other, you did a good job for your client,” Embry says. “There was none of that here.  I’ve never seen people bolt from a courthouse quicker.”

A month later, however, BMW was back – at least digitally — to file motions for a new trial and to set aside the individual awards for Jose Chicas’ sons, who were young adults and lived with their father at the time of the incident. BMW argued that the awards were excessive and improper because they did not meet the legal threshold for loss of consortium.

Will this verdict reverberate in the chambers of industry general counsels? The verdict, and the arguments that led to it, shows that absent broken parts, juries can understand that companies have a responsibility to protect drivers who make split second decisions operating complex systems that their engineers have spent years developing. Blaming the driver for a foreseeable error doesn’t wash in court, just like it doesn’t wash when good systems design processes are followed. 

Fourteen crashes, eight deaths, uninsurable vehicles and auto theft numbers through the roof – that’s the mayhem trailing traditionally keyed, unprotected Hyundai-Kias that appear to violate Federal Motor Vehicle Safety Standard 114 Theft Protection and Rollaway Prevention. But press releases from the National Highway Traffic Safety Administration and the automaker describe the rollout of a software fix without a formal recall.

The crime wave was touched off in 2021, when car thieves in Milwaukee learned to take advantage of a vulnerability in MY 2010-2021 Hyundai and Kia vehicles with traditional metal keys. It began to build to crest in July when a video posted to TikTok demonstrated how to remove the steering column shroud, pull out the ignition cylinder, and using a USB cable, grip the ignition cylinder to twist it, starting the engine. The how-to video quickly went viral, with teenaged thieves posting their exploits under the hashtag “Kia Boys.” Police chiefs from Florida to California to Illinois reported increases in car thefts ranging from 85 to 800 percent. In October, the TikTok challenge was linked to the deaths of four teenagers who crashed a stolen Kia in Buffalo, New York.

Hyundai-Kia’s response after the pressure of numerous negative news stories, and apparently, some from NHTSA, is a free customer service campaign – not a recall – which combines warning stickers, longer alarms and a software patch. According to NHTSA, “the software updates the theft alarm software logic to extend the length of the alarm sound from 30 seconds to one minute and requires the key to be in the ignition switch to turn the vehicle on.” Hyundai’s press release provides a few more details:

“The software upgrade modifies certain vehicle control modules on Hyundai vehicles equipped with standard “turn-key-to-start” ignition systems. As a result, locking the doors with the key fob will set the factory alarm and activate an “ignition kill” feature so the vehicles cannot be started when subjected to the popularized theft mode. Customers must use the key fob to unlock their vehicles to deactivate the “ignition kill” feature.”

Future TikTok influencers will be warned away with a window stickers announcing the presence of anti-theft software.

For owners of MY 2011-2022 models that can’t accommodate the re-flash, Hyundai is finalizing a plan to reimburse them for steering wheel lock purchases.

These vehicles were easily operable without the use of the key, so it’s unclear how they could comply with a 55-year-old standard that the NHTSA promulgated specifically to respond to a surge car thefts and related crashes. FMVSS 114, established in 1968, simply requires:

Each vehicle must have a starting system which, whenever the key is removed from the starting system prevents:

(a) The normal activation of the vehicle’s engine or motor; and

(b) Either steering, or forward self-mobility, of the vehicle, or both

In 2004, former NHTSA Chief Counsel Jacqueline Glassman explained to an unnamed automaker that NHTSA specifically added that bit about preventing either steering forward self-mobility or both to defeat thieves:

“Provision (a) was intended to prevent unauthorized operation of a motor vehicle by requiring that the vehicle could not be started without the key. Provision (b) was intended to further impede unauthorized operation of a motor vehicle by preventing vehicle operation outside the normal activation method. That is, if an attempt were made to circumvent the ignition lock (through “hot-wiring,” for example), another device would prevent unauthorized operation of a motor vehicle.”

Most automakers, including the anonymous manufacturer that wrote to NHTSA nearly 20 years ago, use immobilizers as deterrents. In the 1980s, automakers began to develop immobilizers, defined by NHTSA as “an anti-theft device that combines microchip and transponder technology with engine and fuel immobilizer components that can prevent vehicles from starting unless a verified code is received by the transponder.” GM had a version which used an early generation of microchip devices, “which later developed into the rolling code transponder device.” Other automakers, such as Ford, Chrysler, Mitsubishi and Mazda followed throughout the 1990s, and touted these devices to NHTSA as significantly reducing thefts.

Some of the Hyundai-Kia models favored by young joyriders across the nation weren’t equipped with immobilizers (which are not specifically required under FMVSS 114) – or anything else to prevent vehicles from being started without the key and driven away, which suggests they aren’t compliant with the requirements of the theft protection standard.

Back in the day, NHTSA cited a Department of Justice study showing that 94,000 stolen cars were in crashes in 1966 and more than 18,000 of these incidents resulted in injury to one or more people. According to the report, the crash rate for stolen cars was some 200 times greater than the normal crash rate for non-stolen vehicles. The agency thought this such a serious situation, they wrote a rule to ensure that automakers did not produce vehicles that were so easy to steal.

NHTSA’s approach to Hyundai-Kia is puzzling, given the $210 million civil settlement – the agency’s largest penalty to date – it levied in 2020 for “inaccuracies” and “omissions” in its communications with the agency and a failure to launch timely recalls involving more than 1.6 million Hyundai and Kia vehicles suffering from a manufacturing defect that allowed metal debris to cause premature wear of a bearing that could lead to an engine stall.

And, in the face of what appears to be a non-compliance, if not a complete abrogation of the intent of FMVSS 114, why isn’t the agency requiring Hyundai-Kia a proper recall, which would include an admission of defect, an accounting of how the violation occurred, a formal notification process for affected consumers and an accounting of whether the fix reached enough people or even worked at all.

 

 

It’s been four years since the National Highway Traffic Safety Administration published an analysis of Non-Traffic Surveillance Data, which includes an estimate of the annual toll of rollaway injury and deaths. But the newest numbers are out, and despite some wonky data – blamed on the pandemic – rollaway is pretty much the same threat to public safety it’s always been.

It’s been a long dry spell since NHTSA’s National Center for Statistics and Analysis has published an accounting of rollaway injuries and death, but last week, NHTSA released new stats covering a five-year period, from 2016 to 2020.

During that time, an estimated 12,247 people were killed in non-traffic crashes, averaging 2,449 people each year. Rollaways accounted for 17 percent of the total, with an average of 144 deaths per year. On average, rollaway vehicles injured about 1,886 nonoccupants each year, about 7 percent of that total.

Non-Traffic Surveillance: Fatality and Injury Statistics in Non-Traffic Crashes, 2016 to 2020 noted that: “In this 5-year period, 2020 has the lowest number of people injured in non-traffic crashes and the highest number of people killed in non-traffic crashes – a phenomenon also observed in other National Highway Traffic Safety Administration traffic crash data systems, the Fatality Analysis Reporting System (FARS) and the Crash Report Sampling System (CRSS), possibly because of the COVID-19 pandemic and its related lockdown.”

Some history: Despite the significance of the problem, it took a concerted campaign by safety advocates to persuade Congress that NHTSA ought to be tracking all sorts of vehicle-related safety issues that do not occur on the public roadways – such as SUVs with poor rear field-of-vision, resulting in backovers, or vehicles lacking countermeasures to prevent rollaway. The 2005 Safe, Accountable, Flexible, Efficient Transportation Equity Act: A Legacy for Users (SAFETEA-LU) compelled the agency to collect non-crash death and injury data. And, in 2007, the Cameron Gulbransen Kids Transportation Safety Act of 2007 (K.T. Safety Act) required NHTSA to create and establish a database of such incidents. Besides FARS and the CRSS, NHTSA also uses vital statistic databases and the State Data System of police crash reports to arrive at its estimates.

These analyses began to dribble in April 2014, with subsequent updates in 2016, 2018 and 2022. Over the years, the numbers and percentages of rollaway injuries and deaths have edged up and down.

The first of the three “Not-In-Traffic-Surveillance Fatality and Injury Statistics in Non-Traffic Crashes” reports was published in April 2014 and included data from calendar years 2008-2011. The report tallied 370 fatalities to nonoccupants in rollaways, accounting for about 15 percent of the total of all nontraffic incidents. Injuries during that period totaled 8,000, approximately 6 percent of the total.

In August 2016, NHTSA’s NCSA released its second analysis of not-in-traffic incidents covering calendar years 2012-2014, and found that rollaway vehicles killed 360 nonoccupants during the 3-year period, averaging 120 fatalities per year and accounting for 19 percent of the nonoccupants killed in non-traffic crashes. It also found that an average of 2,000 injuries occurred each year due to rollaways.

The April 2018 publication covered calendar year 2015, noted 142 fatalities in non-driver controlled rollaways and approximately 2,000 non-occupant injuries, accounting for 17 percent of all the nonoccupants killed and injured in non-traffic crashes.

As these data have been collected, some manufacturers have been rolling out in-vehicle rollaway prevention strategies. For example, Fiat-Chrysler Automotive’s Safehold, a software-enabled feature that automatically activates the Electronic Parking Brake to prevent rollaway if the driver exits an unsecured vehicle, debuted on the 2014 Jeep. Some models with electronic shifters employ a strategy in which the transmission will automatically shift to Park if the driver fails to do so before exiting the vehicle, such as Ford’s Return to Park. Despite the significance of the rollaway problem and feasible prevention strategies, implementation throughout the fleet has been slow and spotty.

Meanwhile, another act of Congress, the Infrastructure Investment and Jobs Act, signed into law by President Biden on November 15, 2021, requires NHTSA to finish an evaluation of technology to prevent keyless ignition vehicles from rolling away, and present it to Congress with recommendations for further study or action. Will this data shape NHTSA’s ultimate recommendations?

 

It took an act of Congress, but within the next 18 months, NHTSA is supposed to promulgate a new law compelling manufacturers to implement an automatic engine idle shutdown for keyless ignition vehicles. In two months, NHTSA is supposed to submit a report on anti-rollaway technology to Congress. In the meantime, some manufacturers have already implemented some of these measures. Using internal documents unsealed in litigation, The Safety Record examined how it all went down – in opposite directions – for one major automaker.

The Infrastructure Investment and Jobs Act requires NHTSA, after dithering for a dozen years, to write a rule requiring keyless ignition vehicles to be equipped with an automatic engine shut-down feature to prevent carbon monoxide poisoning, and to explore a solution to the rollaway problem. In the interim, some automakers have responded to the latter with automatic-park or automatic electric parking brake countermeasures, and some have equipped their keyless vehicle with automatic engine shutoffs. But the implementation is spotty across the fleet, and few address both. The Safety Record offers the inside story of how one automaker embraced a solution to the rollaway problem, but rejected a fix to the CO danger – making the case for regulations that provide equal protection to all vehicle owners.

The Infrastructure Investment and Jobs Act signed into law by President Biden on November 15, 2021 set the clock ticking at the National Highway Traffic Safety Administration (NHTSA) to take up – and partly finish – a job that it began more than a dozen years ago: address the increased risks of carbon monoxide poisoning and rollaways posed by keyless ignition vehicles.

By November 2023, the agency is required to promulgate a rule requiring automatic engine shutoffs in keyless vehicles with internal-combustion engines. By this November, NHTSA is required to finish an evaluation of technology to prevent keyless ignition vehicles from rolling away, and present it to Congress with recommendations for further study or action.

Whether NHTSA actually completes these actions by the legally prescribed deadline – and believe The Safety Record – there are no guarantees, is up for grabs. NHTSA has blown so many of them it has been sued by the Specialty Equipment Manufacturers Association, state attorneys general, and the Center for Auto Safety, and prompted Congress to request the General Accounting Office to investigate.

Back in 2009, when NHTSA approached SAE International to gather representatives of industry to write a voluntary standard for keyless push-button designs, only a small percentage of the U.S. fleet had keyless ignitions as standard equipment – about 11 percent, according to Edmund’s. Nonetheless, keyless ignition technology was widespread enough to reveal the safety problems caused by changing drivers’ relationship with the key. In the mid-2000s, the underbelly of this convenience feature was just beginning to show. The Toyota unintended acceleration crisis, in which Toyotas with a drive-by-wire system sped out of control – sometimes at highway speed – showed that drivers were unaware that holding the On/Off button for three seconds was required to shut the engine off while the vehicle was racing down the road.

Owners of keyless ignition vehicles exiting with the key fob, lacking any clear indicators of the engine state, were frequently surprised upon return to find their vehicles still running – or out of fuel. This condition was enhanced by several design characteristics of keyless ignitions – and aided significantly by NHTSA’s 2006 redefinition of a “key.” 

Since 1991, Federal Motor Vehicle Safety Standard (FMVSS) 114 Theft Protection and Rollaway Prevention has required that vehicles with automatic transmissions with a Park position must have a key-locking system that prevents removal of the “key” unless the transmission is locked in Park or becomes locked in Park as the direct result of removing the key. When automakers began to implement push-button ignitions with key fobs in the late 1990s, FMVSS 114 was decades old and written for a mechanical ignition. In 2006, NHTSA revised the definition of the key from solely a physical object to include the electronic code used as the vehicle’s unique identifier in these new keyless systems. This change created a loophole that automakers were able to exploit to technically comply with the standard, even as it created a fleet of keyless ignition vehicles that allow drivers to turn off the engine without putting the transmission in Park, and exit with the key fob, leaving the vehicle free to roll.

In this scenario, many vehicles automatically change the ignition state to “Accessory” Mode. This keeps some electrical functions enabled and the “key” (the invisible code) remains in the vehicle ignition module. Drivers are largely unaware that this is occurring. He or she regards the key fob as the key (which is reinforced by automakers descriptions in owner’s manuals and in-vehicle alerts), and believes that if the key fob is in hand and out of the vehicle, the transmission must be in Park. Some automakers included information about the transition to Accessory mode in dense owner’s manuals; some did not. The in-vehicle alerts automakers use to encourage drivers to shift the vehicle into Park are typically low decibel, indistinct chimes that stop in seconds and fail to adequately alert drivers who are often already out of their vehicles.

The first publicly acknowledged carbon monoxide deaths occurred in 2006 involving a Toyota Avalon unintentionally left running in an attached garage.

Vehicle rollaway is a persistent problem that NHTSA has estimated causes at least 150 deaths and 2,000 injuries annually in the U.S. In 2007, NHTSA got its first consumer complaint about the potential for rollaway in a keyless ignition vehicle:

“I do not own the 2007 Lexus ES 350 or the Toyota Camry but in the course of test driving both of the vehicles, I was shocked to discover that the “start/stop” button defeats the older ignition key interlock system. In the older keyed ignition system the car must be in park to turn off the engine and remove the key from the ignition.  In the 2007  models of Lexus and Camry the engine can be turned off with the vehicle in drive simply by touching the brake–there is no ignition key to place in the steering column.”

The manufacturers failed to heed these warning signs, relying on audible or visual alerts that were often not perceived or understood by the driver. The Recommended Practice released by the SAE Keyless Ignition Controls Sub-Committee in January 2011 was so lame, the agency published its own Notice of Proposed Rulemaking to amend FMVSS 114, Theft Protection and Rollaway Prevention. But NHTSA’s solutions weren’t much better. The agency pointedly eschewed any requirement that keyless vehicles have an automatic engine idle shutdown feature, because drivers might want to leave their vehicles running for long periods of time to keep their pets comfortable – never mind that in the past, NHTSA considered an unattended idling vehicle to be a safety hazard. A technological solution to preventing rollaways had been marketed to OEMs since 2010 by supplier ZF TRW in the form of an automatically applied electric parking brake, but EPBs were not widespread at the time. So NHTSA also proposed audible warnings – but loud enough to break through the fog of a distracted driver – 85 decibels, also loud enough to garner an enormous pushback from manufacturers, petrified of annoying customers.

Manufacturers were steadfastly opposed to the NPRM, accusing NHTSA of pushing a new regulation without doing adequate research to justify this change. Meanwhile, as they helped write the SAE RP and joined the protest against the NPRM, Ford and GM were designing their own automatic engine shutdown features, quietly released in calendar year 2012 for model year 2013 vehicles. In 2019, Toyota implemented an automatic engine shutdown feature in the majority of its MY 2020 Toyota and Lexus badged models.

Today, keyless push-button ignitions are ubiquitous – 91 percent of new vehicles had this design as standard in 2019.  Ford, Toyota and GM have all implemented a timed automatic engine shutdowns. Typically, these shutdowns kick in after 30 minutes to an hour, with a warning to the driver that it is about to occur and a mechanism to continue idling. But this feature was not adopted as a safety measure wholesale by the industry. And drivers are still dying from carbon monoxide poisoning in keyless ignition vehicles – with recent incidents occurring in  Missouri, Florida and Georgia in the last several months.

 

FCA: A Leader and a Laggard

The story of Fiat Chrysler Automobiles approach to these keyless ignition hazards, provides an excellent illustration of how technology can provide robust prevention from keyless ignition-related death and injury – and why it was necessary to pass a law compelling automakers to do so.

This narrative was constructed, in part, from FCA internal documents found in unsealed exhibits in Lawson v. FCA. The 2019 case, filed in a Virginia federal court, sought to hold FCA accountable in the July 2017 death of Lee Trinkle Lawson, who succumbed to CO poisoning, after inadvertently exiting his 2016 Dodge Journey with the engine running and the key fob in his pocket. The vehicle idled in his basement garage, as Lawson went upstairs into his home and was later overcome by fumes as he slept. In August 2021, Chief U.S District Michael F. Urbanski granted FCA’s motion for pre-trial summary judgement, ruling that the 2016 Dodge Journey met federal safety and industry standards, and that the Plaintiffs failed to provide sufficient evidence that consumers expected a keyless ignition vehicle to automatically shut down if the driver neglects to do so.

In the late summer of 2013, engineers at Chrysler Group LLC, now Fiat Chrysler Automobiles (FCA), were responding to the rollaway and the carbon monoxide hazards in two different ways. The company was about to introduce the new Jeep Cherokee as a 2014 model year, equipped with Safehold, a software-enabled feature that automatically activates the Electronic Parking Brake (EPB) to prevent rollaway if the driver exited an unsecured vehicle. According to FCA:

Safehold is a safety feature of the Electric Park Brake System that will engage the park brake automatically if the vehicle is left unsecured while the ignition switch is in RUN. For automatic transmissions, the park brake will automatically engage if all of the following conditions are met:

– The vehicle is at a standstill

– There is no attempt to depress the brake pedal or accelerator pedal

– The seat belt is unbuckled

– The driver door is open

At the time Safehold was, and continues to be, one of the very few thorough rollaway countermeasures designed to work any time the driver attempts to get out of a keyless ignition car without putting the gear selector in PARK.

The Safety Record can tell you that people are run over by their own vehicles with surprising and depressing regularity. Drivers get out of their vehicles in the firm belief that the sequence of exit actions executed flawlessly thousands of times prior was once again successfully completed. Except for the time, in haste, or in the midst of all the distractions of modern life – and absent any clear feedback from the vehicle, in the form of creep torque or a significant and immediate warning  — that they neglected to put their vehicle in Park.

Sometimes they have turned the engine off; sometimes they have left the engine on intentionally – to keep the air-conditioning running, for instance – or unintentionally. The torque to the wheels when a vehicle is idling in a drive gear on an inclined surface or the tires are in a parking garage seam, for example, can hold the vehicle quietly in place. Rollaways ensue when someone reaches in and shuts off the engine and the torque holding the vehicle in place is removed, or in some instances, when the engine idle increases to support A/C, for example, the little added power can be enough to get the vehicle over an uneven surface. Rollaways often happen so fast, that the audible alerts that most manufacturers use, which sound much like every other alert in the vehicle, give drivers no time to understand the message the vehicle is trying to convey — much less take action.

So many of today’s vehicles equipped with EPBs or electronic shift selectors capable of automatically shifting the vehicle into PARK if the driver doesn’t are only programed to work under narrow and discrete conditions. For example, most automatic engine start-stop features, in which the engine is turned off during temporary stops – such as at a traffic light – and then enabled when the driver depresses the accelerator to resume travel, automatically apply the EPB if the driver attempts to get out of the vehicle while the vehicle is stationary while in automatic start-stop mode. Many vehicles automatically activate the EPB after the driver has put the transmission in PARK. Others are only activated if the engine is turned off while the transmission is not in the PARK gear.

Safehold has always stood out as a design that could avert a disaster following an easily made mistake. It really had no peers in 2014 model year vehicles.

Around that same time, an FCA human machine interface engineer Lori Rodner was finishing up a Design for Six Sigma (DFSS) project addressing drivers inadvertently leaving a keyless ignition vehicle running. DFSS is an engineering design process comprised of specific steps to improve processes or remove defects. At the time, FCA was pushing for its engineers to become trained in the Six Sigma process and complete one project using the DFSS approach. Rodner testified that as an HMI engineer there weren’t many “meaty” issues, but she had heard anecdotally about drivers mistakenly leaving their vehicles running, and decided to pursue the issue to obtain her Six Sigma “green belt.”

In fact, FCA had gotten complaints going back to 2010 from consumers who left their Chrysler or Jeep running and thought that was a dangerous design. For example, in August 2010, a Jeep owner in San Jose, CA called Chrysler’s customer care line to relay her experience:

“I made a mistake today that I walked away from my 2011 Jeep Grand Cherokee Overland after lunch. I didn’t realize that I didn’t turn off the engine before I walked away going back to work in the office. 4.5 hours later, I was ready to go home. When I got close to my Jeep, my Jeep was still running 4.5 hours later without any key close by and without any driver inside. Can you imagine if I parked my Jeep in my garage (instead of outside parking space) running for long hours? It is not safe, and we didn’t expect it could happen. Can you explain why this is allowed? I need some kind of explanation, please. I am scared now.”

In August 2011, the owner of a Jeep called the customer assistance line to report a close call: 

“[S]he parked her vehicle in the garage at her home and turned off the key and went in the house. Customer states that her carbon monoxide detector went off in her home, and went out to the garage and her vehicle was still running, and the gas tank was empty. Customer states that the fire department was called, and the carbon monoxide levels were too high in the house, that the fire department advised customer to take her family (7 people) to a hotel for the night.”

Another characterized the vehicle running without the key as “something wrong with my car. That Dodge, Chrysler believes that it’s normal … to me it’s a safety issue.”

And contrary to the judge’s conclusions about customers’ expectation that the engine would automatically shut off, these complaints also showed that, in general, FCA customers, dealers, and customer care agents did not understand how a keyless vehicle with a pushbutton ignition would behave if the engine was running and the fob was no longer in the vehicle. Many assumed it was a proximity device, and would automatically shut off at some point.

For example, in June 2011, one customer called to report that “she took the key off from the ignition and the vehicle was still running and was taken it in to the dealer for diagnosis. She said that she was informed that the vehicle can be running without a key up to 100 yards.”

Another example:

“Customer had an inquiry about the distance between the vehicle and the fob for the vehicle to turn off. Agent advised customer per owner’s manual after 30 minutes of activity the vehicle should shut off. Customer states he was away from the vehicle for over 3 hours and a ½ miles away and the vehicle was still running. Customer states he had the keyfob in his pocket…Agent found the information required. The approximate range for the key fob is 300 ft. (91m).”

In other cases, the customer service representative told a keyless ignition vehicle owner that the engine would automatically shut down at some point:

“The agent explained to the customer that the vehicle all ready [sic] has a 15min automatic shut off. The customer states that the issue is would it really shutdown. The customer states that he is concerned that the vehicle will not shut off he will try the 15min interval. Agent told the customer that according to the owner’s manual it will shut down.”

“The car is so quiet. I could not tell it was running when I went in the grocery store the other day, and locked the door without turning off the engine. Luckily, I had the key. Is there a backup in case I forget to turn off the car? Not used to the button method just yet. Will it shut off after so many minutes on its own? Thanks. Dear Elizabeth: Thank you for contacting the Dodge Customer Assistance Center regarding your 2012 Charger. According to your owner’s manual on page 362: NOTE: If the ignition switch is left in the ACC or RUN (engine not running) position and the transmission is in PARK, the system will automatically time out after 30 minutes of inactivity and the ignition will switch to the OFF position.”

“I have the keyless enter and go. The key fob was in my pocket when I left the locked running van, which I was not aware that the van was running. I would be nice if there was a way to set a maximum running time like there is for remote start. Dear Terry: Thank you for contacting the Chrysler Customer Assistance Center once again. I have received your most recent response and posted it to your file. According to you owner’s manual I believe that your engine should have stopped running after a designated period of time.”

Out of 47 discrete keyless complaints in the exhibit, there were 17 instances in which FCA provided a substantive response to a consumer’s question about how the keyless system works. Twelve of them contained incorrect information.

In September 2010, NHTSA met with FCA to discuss keyless ignition vehicles and the complaints it had been receiving. Its top three: Distracted drivers shutting down their vehicles without putting the transmission into Park, drivers putting the vehicle in park but leaving the engine running, and drivers not knowing how to shut the engine off at high speed – a panic stop. NHTSA itself was in the process of deciding on whether to amend FMVSS 114.

According to internal emails, in 2011 FCA had briefly and preliminarily considered adding an automatic engine shutdown or more salient audible warnings, such as an external chime. But the idea of an automatic engine shutdown didn’t go very far, and the external chime was ditched as too costly.

Engineering Manager Neil Borkowicz explained it this way to a colleague in an email: “We talked about the chime here at Chrysler but no one in vehicle development at the time wanted to pay for a $5 external chime – the issue was smaller at that time.”

In 2012, Rodner gathered a team of 14 FCA staffers – including participants from HMI, Safety, and Regulatory offices, and electrical and ignition engineers – to study the problem of drivers inadvertently leaving their keyless ignition vehicles running, to propose solutions, and to make design recommendations. The problem, Rodner noted in a presentation, was tied to the rise of keyless ignitions, the lack of obvious cues that the engine was still running, quieter engines, more distractions, and busy lifestyles.

They took a multi-pronged research approach that included user surveys of behaviors and attitudes, benchmarking, and an assessment of the efficacy of vehicle warnings. One of the group’s first steps was to conduct an in-house survey of keyless ignition vehicle drivers who had inadvertently left their engines running. The survey was only directed at keyless ignition vehicle users who had inadvertently left the car running, and thus did not measure the prevalence of these incidences relative to all of the keyless ignition vehicle owners. The survey asked questions about the circumstances of the incident, where the “key” (meaning the fob) was located, how many times had it happened and a description of the driver’s feelings about it. An email sent to FCA’s Auburn Hills employees immediately garnered 160 responses, eight personal visits, and six phone calls. Eventually, the team heard from more than 300 employees.

The responses allowed the team to get a pretty good idea of the factors that made it easy for users to make this error. They used the survey results to develop customer “I want” statements about their keyless ignitions, and identified the main customer “wants.” They then supplemented the in-house data with a survey conducted via iCommunity, an on-line Consumer Research site, and another targeted to owners of Chrysler keyless ignition vehicles. In total, they garnered 599 responses. These indicated that the three things customers wanted from their keyless ignition vehicles were: a clear indication from the vehicle that the engine is still running when they are exiting, confidence that the engine is off when they think they’ve turned it off – even when distracted or in a hurry, and a clear indication that the engine is not running, each time they turn off the vehicle.

Other aspects of the research projects included: An internet search of keyless ignition incidents in which drivers complained about inadvertently leaving their vehicles running; a Vehicle Chime survey which benchmarked the alerts found in 21 of their competitors’ keyless ignition vehicles from the 2010-2013 model years; and an analysis of internal customer complaints gathered from FCA’s Customer Assistance Information Reports (CAIRs).

For the chime survey, 77 employees rated the salience of the interior and exterior alerts in seven competitors’ models. The Hyundai Genesis got the top rating, but testers concluded that “although the Hyundai Genesis fared much better, 7.0 and 5.5 respectively, the chime alert was not effective in either situation. Comments included: not loud enough, not long enough, don’t know what it means, not sure where sound was coming from, would not notice if distracted/hurried.”

The CAIRs review found 31 total keyless complaints. FCA’s Mike Schutter, who did the CAIRs key word search said “A majority of customer calls are in conjunction with a request for goodwill assistance, whereas these cases were, in general, just notifying us of this and suggesting ways to improve it, so having 31 in a year is pretty significant.”

To brainstorm solutions, the group conducted a Pugh analysis (A basic decision matrix often used in engineering in which a set of options are scored and then summed to gain a total score which can then be ranked.) The solution had to be effective at preventing people from leaving the engine running when they were in a hurry or distracted, was not annoying, and allowed the driver to leave vehicle running when desired. The Pugh matrix considered whether the possible solution was effective in all lighting and noise environments, could be applied across the fleet for both manual and automatic transmissions, was intuitive, and met regulatory requirements. The analysis’ final recommendations included adding a Cognitive Cue each time engine is turned off, a reminder and an automatic shut-off feature.

The group also recommended that in the future, FCA study the implementation of vehicle logic to avoid a rollaway scenario using such countermeasures as Automatic E-shift to Park or Electronic Park Brake activation.

In summing up the critical lessons learned, the team stated:

• “New technology creates new unique issues. Need to fully validate new technology with special attention to analyze and protect for human error.
• Following competitive set actions may not lead to the best customer solution.”

Despite the work of this team identifying that a significant portion of drivers inadvertently left their engines running, that their customers expected the vehicle to turn itself off, and would support such a feature, the idea of implementing an engine idle shutdown never resulted in a company policy change.

In November 2013, Borkowicz explained that warnings were insufficient to catch the attention of a distracted driver, but an automatic shut-off shutoff would create its own issues:

The only way to prevent these cases of the car remaining running is to shut it off. As the DFSS points out these customers are so distracted that they do not see or hear that the IP is still on, the radio is on, the car engine is running as they walk away, and in the case of the Asian OEMs, the external chime is going off. This has to be weighed against our usual desire to keep the car running. The option that allows you to keep hitting a:

“continue running” button depends on the person remaining in the car understanding it and acting in the available time, if I leave my 85 year old mother in the car in the middle of winter while I go into a store, I guarantee the car will not be running when I come back. She will be upset that she is cold (not that I would do that). Will we like that complaint any better? Or worse yet, the mom stuck in a snow storm with a weak battery, if she misses hitting the continue button because she turns to her baby crying in the back seat, I am pretty sure she will not be happy either about not being able to get her car going again.”

The idea re-surfaced in 2016, when Muqtada Husain, Assistant Chief Engineer of the Electrified Powertrain group gathered a multi-disciplinary team to discuss it, and expressed skepticism about the wisdom of leadership’s decision to forego an automatic engine idle shut-down feature:

“I assume FCA, being a customer focused organization would have already thought through all aspects of this decision, especially in light of vehicles getting quieter, driver’s [sic] getting more distracted etc. NHTSA current proposal of a warning alarm is not good enough and I am sure in light of various field incidents, some appropriate regulations will eventually get formulated. I may not be aware of all the pros and cons In this case, so it you don’t mind, I would like to schedule a small circle discussion to get myself more    educated on why we can’t entertain “auto-off” after 30 minute timer in such cases. Thank you in advance for your support.”

With Husain as the feature’s champion, the MY 2018 Pacifica Hybrid became the first FCA keyless ignition vehicle to have an automatic engine idle shutdown. But the feature did not spread to other carlines.

In contrast, FCA’s rollaway counter-measures spread throughout its fleet, and in addition to SafeHold, FCA went on to implement AutoPark on electronic shift selectors. FCA described AutoPark as “an enhanced securement strategy which places the vehicle in “PARK” if the driver attempts to exit the vehicle before placing the rotary gear shift selector in the “PARK” position.”  FCA’s first foray into AutoPark started in 2013 model year Dodge Ram trucks – but only those with the Engine Start/Stop (ESS) technology – a limited-population vehicle. ESS technology automatically shuts off the engine when a driver stops for a traffic light, and then restarts the engine when it’s time to resume driving. In 2016 FCA recalled Jeep Grand Cherokees and other models with monostable E-shifters following a spate of rollaway crashes, adding the AutoPark safety feature by re-flashing the controls with updated software. In 2017, FCA added AutoPark to the 2017 Dodge Ram with electronic rotary style shifters.

The FCA story, shows, in a nutshell, why, absent regulation, safety features are an inconsistent patchwork –from manufacturer to manufacturer and even within a single manufacturer. Engineering managers shepherd to production a particular advancement that makes on to one vehicle, or some other vehicles, or no other vehicles. Another demonstrates quite credibly that its own employees and customers are making a dangerous error with new technology, but the higher-ups aren’t interested in fixing it. The mix of development, production, and warranty costs, negative headlines, positive PR, individual interest, and institutional will influence whether a model stands up to the safety chest-beating automakers are so fond of doing or continues a hazardous design until NHTSA finally makes its move.

Perhaps by the 2024 model year, FCA will address the safety deficits in its keyless ignition designs that Lori Rodner pointed out a decade earlier. And the rest of the “automotive innovators,” as the industry likes to brand itself, can catch up and use now old technology such as EPBs with auto-apply functions to prevent rollaways, or timed engine idle shutdowns to prevent CO poisoning, that should have accompanied the introduction of keyless ignition systems in the first place.

Neil Black, Tom Mueller

On February 25, Ken Rothfield was backing down his driveway at about 7:30 a.m., and noticed that there was barely enough room to ease his vehicle between the brick wall jutting out to his left, and his wife’s Toyota on the right. He pulled a bit forward of the wall, with the intention of re-parking his wife’s car to create more space. He got out, and left the driver’s side door open – moving the Toyota would just take a few moments. And in just a few moments, Rothfield was pinned between his Chevy Volt and the brick wall, in excruciating pain and shock.

In an account of the rollaway incident, Rothfield wrote: “Things happened very quickly, and I recall only three vivid images: Looking into the driver’s compartment and realizing there was no way for me to get back inside and hit the brake; Looking forward as the open door struck me and drove me backwards between the car and the brick wall. I could feel my arm getting trapped between the wall and the car above the door, and thought I would be torn apart and crushed; A sudden stop – The door caught the wall. I was now in a seated position with my left arm trapped above the door, between the car and the wall. Both legs were trapped below the door between the car and the wall.”

With his focus on getting to work that morning, Dr. Kenneth Rothfield, Chief Medical Officer at Texas Health Resources Arlington Memorial Hospital thought he shifted his transmission into Park. And his 2017 hybrid electric Volt, which GM assured customers in a marketing brochure “We’ve got your back. And sides. And front,” didn’t do a thing about it. Tricked out with computers, radar, sensors, and cameras, fully connected to Siri, smart phones and Apple Car Play with built-in 4G LTE Wi-Fi®, and loaded with advanced features, such as automatic braking and steering to prevent collisions, adaptive cruise control, automatic parking and intelligent headlamps, the 2017 Volt didn’t even warn Rothfield that he was about to exit an unsecured vehicle.

His entreaties to Siri were ignored, he could only manage a few honks of the horn before his other hand gave out. In the end, Rothfield yelled for five minutes until a neighbor came to his aid. Dr. Rothfield sustained a number of injuries — three broken ribs on the right, complex lacerations to his left shin, complete dislocation of his left elbow, and a complex soft tissue lesion of his thigh that required two surgeries and many weeks recovery.

Much of Dr. Rothfield’s estimable career as a hospital physician executive has focused on patient safety, risk management, and public health. He was shocked to learn that the auto industry treated the rollaway problem so cavalierly – with a patchwork of half-measures, or no measures to mitigate a well-known safety hazard.

“As a safety/public health guy, you know there are no accidents!” he says.

Real-world rollaways are split-second catastrophes that happen under a wide variety of circumstances. The engine may be on or off, the transmission might be in Reverse, Neutral, or Drive. But absent a vehicle failure, rollaway incidents occur when the driver believes that the vehicle is secured, and absent instant and clear feedback to the contrary, steps out of the car. Just as Rothfield learned that February morning, that mistake can lead to life-changing or -ending consequences. Drivers underestimate how tricky it is to stop a moving vehicle once they’ve begun to exit, or are completely outside, how easily and quickly they can be knocked under the wheels, and how deadly even a slow moving two-plus ton rolling machine can be when those forces are exerted on the human body.

Following are some recent incidents that have come across The Safety Record’s desk. While the circumstances of each are slightly different, they share a common theme: the drivers thought they had secured their vehicles, because they were stationary. However, the vehicle itself is no longer a clear source of engine or transmission state. The old tells – such as the sound and vibration of the running engine – have largely been eliminated by design (more on that below). Automakers have replaced these traditional cues with audible alerts and visual messages. But in many cases, they are indistinguishable amongst the many non-descript alerts and fail to convey any urgency about the potential hazard, especially in the seconds it takes the driver to get out of a vehicle and their attention already turned to the next task.

• Last August, a Pennsylvania woman died when her 2020 Avalon Hybrid rolled over her as she tried to put some towels in the trunk. The vehicle was running and remained stationary on their sloped driveway as her husband got out to help her with the trunk. Neither realized that the trunk wouldn’t open because the transmission was not in Park.
• In July 2020, a Kentucky woman had exited her 2017 Ford Escape with the engine running, parked outside a convenience store. She subsequently reached into the vehicle, when it began to roll rearwards. The driver attempted to get back into her vehicle, but it knocked her to the ground and ran over her leg.
• In Los Angeles, two rollaways involving Range Rovers killed one woman and injured another. In the latter incident, the driver exited her 2019 Range Rover in her garage, thinking that the rotary shifter was in Park. After she got out of the vehicle, it began rolling backward. The Range Rover knocked her unconscious and rolled over her hand, crushing it while her four-year-old son was in the back seat. The fatal incident occurred in October 2018, when the woman exited her stationary 2017 Range Rover, which subsequently reversed over her.
• In December 2019, a New Jersey man exited his 2018 Nissan Rogue to check his mailbox. When it started to roll, he attempted to stop it, and was fatally crushed between his vehicle and another parked minivan nearby
• In June 2018, an Oklahoma woman was seriously injured when her 2019 Kia Forte backed over her. She had inadvertently left it running and in Drive in a sloped driveway, holding the vehicle stationary. When she realized the engine was still running, she reached in to turn off the ignition, setting the Forte into motion.
• In March 2018, a grandmother was killed due to a rollaway involving a 2013 Nissan Altima in Connecticut. She had just returned from picking up her grandson, and waited in the driveway for him to wake up with the engine running, to keep the heat on. When he woke up, she exited the running vehicle, not realizing it was still in Drive because it held in place. She retrieved her grandson from his child seat. Leading him by the hand, she walked back to the driver’s side and reached in and shut off the engine. The vehicle immediately rolled backwards, knocking her over and pinning her under the car. Her grandson was found by a neighbor wandering around the yard.

 

Some of these vehicles offered limited rollaway protection, some had technology that could have prevented a rollaway, but wasn’t designed to do so, some allowed the driver to get out of a vehicle not in Park without so much as a warning. Those vehicles with “warnings” often provide little connection to the hazard, and there’s no time to consult the owner’s manual – which is often voluminous, confusing, with significant omissions and sometimes inaccurate information Automakers have the tools to fix it, but few do — it’s easier to blame users, and it’s worked for the industry.  

The most recent death and injury numbers published by NHTSA’s National Center for Statistics and Analysis (NCSA) in April 2018, based on the agency’s Non-Traffic Surveillance (NTS) System, estimated 142 people were killed and 2,000 injured in 2015 due to rollaways involving an unattended vehicle with no driver in control.

Rollaways accounted for 17 percent of all non-traffic deaths and injuries. Like all of the non-traffic incident data, the number of rollaway deaths and injuries are based on estimates, and likely undercount the scope of the problem. Because the majority of rollaways don’t occur on public roadways, rather they are the province of private driveways and parking lots, they don’t garner the same reporting mechanisms as on-road vehicle incidents. It’s also why NHTSA had to be compelled to collect the data in the first place. From the agency’s inception, it defined its motor vehicle safety mission in the context of vehicle performance on public roadways, and the agency resisted calls to collect motor vehicle hazard data or regulate vehicle performance related to non-crash incidents, such as power window and trunk entrapments or backovers.

In 2005, Congress mandated that NHTSA begin collecting non-traffic death and injury incidents associated with backovers as part of the $244.1 billion transportation bill, the Safe, Accountable, Flexible, Efficient Transportation Equity Act: A Legacy for Users (SAFETEA-LU). Backover incidents, occurred frequently in residential driveways, often involved a child who entered the blind zone, an area behind the vehicle that isn’t visible to the driver due to vehicle design characteristics, as it was reversing. These deaths and injuries were not accounted for in traditional motor vehicle-related deaths and injuries data, which only included incidents occurring on public roadways. In 2007, the Cameron Gulbransen Kids Transportation Safety Act of 2007 (K.T. Safety Act) took things a step further, requiring NHTSA to create and establish a database of non-traffic death and injury (those that don’t occur on public roadways) incidents.

By law, the Non-Traffic Surveillance (NTS) database is required to be accessible to the public and is described by NHTSA as “a virtual data collection system designed to provide counts and details regarding fatalities and injuries that occur in non-traffic crashes and in non-crash incidents.” In its first report covering rollaway in 2014, researchers noted: “The statistics reported in this statistical summary are based on the NiTS data 2008–2011. Since a complete record of all nontraffic crash fatalities from States and police jurisdictions is not available, adjusted weights have been used to obtain national estimates.”

NTS relies on NHTSA’s National Automotive Sampling System, General Estimates System and the Fatality Analysis Reporting System for non-traffic crash data. The non-crash injury data is based on emergency department records “from a special study conducted by the Consumer Product Safety Commission’s National Electronic Injury Surveillance System (NEISS) All Injury Program” and the non-crash fatality data is derived from death certificate  information from the Centers for Disease Control’s National Vital Statistics System.

Based on summaries of the data in three reports published by NHTSA’s NCSA covering non-traffic crashes, during 2008-2015 an estimated total of 787 deaths and 17,000 injuries occurred due to vehicle rollaways. 

The Human Factor

In the past, rollaway was mostly a function of a component failure like misaligned linkages, or broken parking pawls, or a design defect that allowed a transmission to slip from Park into Reverse. But the advent of advanced automotive technology has made it increasingly likely that a rollaway occurs because the driver isn’t provided with adequate indicators about the state of the vehicle. And, despite the ever-increasing features designed to mitigate or prevent outcomes that can harm the vehicle, the driver, or those around a vehicle, many modern vehicles fail to provide any real warnings of eminent hazard and fail to use already existing sensors, hardware and electronic control modules to prevent rollaway.

The reasons for rollaway are many. For one, it’s gotten harder to understand exactly what power and engine state the vehicle is in, as vehicle designs have eliminated many of the visual and audible cues. The keyless ignition radically changed the way drivers interact with their vehicles. The metal car key on a ring with the house key and other essential keys that drivers needed to have after they parked and exited their vehicle is passing into history. With the metal car key in hand, the driver was assured of two things: the engine was off and the gear shift lever (on an automatic transmission) was locked in Park – otherwise the vehicle ignition key couldn’t be physically removed from the ignition cylinder.

With the aid of NHTSA, through its redefinition of what constitutes a “key,” automakers are able to provide a key fob that appears to act like a regular metal key and is often referred to as the “key” by car companies. In reality it’s a key carrying device. The actual key is an invisible code transmitted by the fob that enables the vehicle to start when the fob is brought into the occupant compartment. While the fob is a proximity device for starting the vehicle, unlike the metal key, removing the fob from the vehicle has no effect on the engine and transmission state. Drivers can exit with their fob thinking that the vehicle must be off and secured or they may turn off the engine without placing the gear selector in Park. In that circumstance, many models surreptitiously move the ignition state to Accessory mode, to keep the electronic key code in the ignition, and to meet the requirements of the federal safety standard that mandates: when the “key” is removed from the vehicle, the ignition must be off and the transmission locked in Park or become locked in Park automatically. Thus, after turning off the engine with the vehicle in gear, the driver is unlikely to know that the automaker just flipped the ignition to Accessory in order to technically comply with the standard, if they don’t have an automatic means to shift the vehicle into Park. The manufacturers willingness to use this loophole in the standard means the driver often has no clue about these states. What they do know is that they were able to shut off the engine and exit the vehicle with the key fob, which they believe is the key.

Modern passenger vehicle operations have fundamentally changed, and with it, the driver’s relationship to the vehicle controls. No longer assemblages of separate mechanical systems, today’s cars are complex, integrated networks of sensors and computers that communicate with each other. Rather than directly controlling the car, the driver is less of an operator and more like a supervisor who makes requests while hundreds of sensors report information about the environment, conditions, and driver actions to numerous interconnected electronic control units (ECUs). In turn, the ECUs make decisions based on these inputs under the software algorithms automakers have designed. In many instances, automakers use these systems to prevent a catastrophic or unwanted event from occurring, to compensate for inattention, and even override the driver’s input. For example, depressing the accelerator pedal to the floor while driving on a slippery road, don’t expect full throttle and spinning tires — your request will be overridden by the vehicle electronic controls to reduce the engine output and apply braking automatically until traction is regained. Similarly, most automatic transmissions prevent the driver from selecting the Park gear, intentionally or not, when the vehicle is moving above a pre-determined speed (usually 2 mph) – even in models with mechanical shift selectors – to prevent transmission damage and possible loss of control.

Many other systems commonly found in vehicles are specifically designed and marketed to protect drivers from inattentiveness or operating errors. Page through any marketing brochure or owner’s manual, and you’ll find dozens of examples of such features that protect the vehicle or the driver – headlights that automatically shut off after a set time, seat heaters that turn themselves down or off after reaching a certain time or temperature level, brakes that automatically apply if you get too close to the vehicle in front, or steer your vehicle back into the lane of travel if you drift over the line, cruise control systems that prevent you from getting too close to the lead car, automatic emergency braking systems, electronic stability control, and low oil engine shutdowns.  

In some cases, the countermeasures are applied in ways that driver may not detect. For example, if the driver turns off the engine of an MY 2015 Ford Edge but leaves the ignition in Accessory, after 15 minutes, the battery saver feature will turn off the power state to prevent the battery from discharging.

A driver exiting their vehicle without securing it in place is simply another condition – but with a potential for death, injury, or property damage – that can and should be prevented when detected by vehicle systems already in use.

Decades of Options, Few Taken

For nearly two decades, automakers have preferred to use to primary ways to prevent rollaways: an electric parking brake (EPB) automatically applied any time the driver exits the vehicle, or in vehicles with electronic shifters, an automatic shift to Park anytime the driver fails to do so before exiting the vehicle. (We note that there are other ways automakers can prevent rollaways in vehicles with mechanical shifters and parking brakes through controlling torque to the wheels.) For example, FCA’s Safe Hold, introduced in 2014, and on Jeep, Chrysler, and Fiat models, automatically sets the parking brake anytime the driver attempts to exit an unsecured vehicle, regardless of engine state. Similarly, Ford’s Return to Park feature, first implemented in the 2017 Fusion rotary shift knob, automatically shifts the transmission into Park anytime the driver attempts to exit an unsecured vehicle. (For more about these technologies, read our 2018 story The Persistence of Rollaway)  

These are the exceptions. A survey of anti-rollaway features among all automakers shows how slowly these technologies have spread through the US fleet, and how infrequently they were and are used as an effective rollaway countermeasure – if at all. Take EPBs – early adopters, such as Ford and Toyota began equipping their luxury lines with EPBs in calendar year 2002 (MY 2003 Lincoln LS and MY 2003 Jaguar Type S) and 2006 (MY 2007 Lexus 460LS). Yet, neither included EPBs widely among its other models. Ford Motor Company didn’t install an EPB on another U.S. Ford model until the 2013 Fusion. Toyota, which had been researching and patenting EPB technology since 1999, installed EPBs on some Lexus models, but not on any U.S. Toyota-brand model until the 2018 Camry Hybrid and the 2018 C-HR.

The vast majority of EPB systems only apply automatically once the transmission has been shifted into Park, periodically as a system-check, or in other narrowly defined circumstances. For example, Jaguar Land Rover’s Queue Assist – an adaptive cruise control feature that keeps a set distance between your car and the one in front of it — automatically applies the EPB if the vehicle has come to a stop while in Queue Assist mode, and the driver attempts to get out of the vehicle.  

require the driver to activate this feature manually at every key cycle by depressing a button. Most manufacturers include a rollaway countermeasure in their fuel saving engine stop-start algorithms: if the driver brings the vehicle to a stop, and the engine automatically shuts down, and the driver unbuckles their seat-belt and opens the driver’s door, the EPB will automatically set. This same basic algorithm can be used to apply the EPB in situation in which the gear shifter is not in Park and the driver attempts to exit the vehicle.  

Manufacturers are more likely to pair an automatic anti-rollaway feature with e-shifters – often because of the recognition that e-shifters, such as rotary dials or monostables, are less intuitive and fail to provide the driver with a level of tactile and visual feedback found on traditional mechanical shifters. Notably, many vehicle models with e-shifters and are programed to auto-shift to Park only when the driver turns the engine off.   

There is another large group of vehicles in which the rollaway prevention algorithm is just shy of being complete, because the automatic shift-to-Park does not activate under all potential rollaway conditions when the vehicle is in Neutral. These include models manufactured by Mercedes, BMW, Hyundai/Kia, Volvo, Audi, Nissan/Infiniti, and Jaguar Land Rover. Many automakers appear to do this to allow a vehicle to roll in Neutral for towing or automated car wash purposes. However, most transmission shifters allow the driver to shift into Neutral without stepping on the brake – and in real-world scenarios, rollaways occur because the shifter can be inadvertently bumped into Neutral. Car wash modes are best accomplished through a stepped process that requires the driver to intentionally select non-standard procedures to prevent unintended Neutral rollaways.

You are the Countermeasure

 Manufacturers don’t need out-of-date NTS data to be aware of this problem. In 2009, industry representatives, at NHTSA’s request, formed an SAE keyless ignition controls sub-committee to write a recommended practice addressing the carbon monoxide poisoning and rollaway hazards associated with keyless ignitions. In 2011, SAE published the result – a recommendation for warnings, so vague and apparently so dissatisfying that NHTSA moved to amend Federal Motor Vehicle Safety Standard 114 Theft Protection and Rollaway Prevention. In December 2011, the agency published its proposal for explicitly loud, hard-to-ignore warnings. (See Keyed up With Anticipation: Smart Key Hazards Still Unresolved  )

The Notice of Proposed Rulemaking recognized, in unambiguous language, that the current keyless ignition systems had led to driver confusion, resulting in vehicles left running and/or out of the Park position, and the consequent rollaways and carbon monoxide (CO) poisonings. It also acknowledged that under the current designs, drivers can and do exit the vehicle without the transmission locked in Park, and sometimes without actually turning off the engine. The NPRM noted that the lack of standardization in combination with the lack of visual and tactile cues about the status of the vehicle engine has set the stage for the real-world incidents in which drivers, mistaking the fob for the key, inadvertently leave a vehicle running and/or exit the vehicle without putting the transmission into Park. NHTSA’s recommended countermeasures for the rollaway and CO threats were the use of audible alerts. The agency proposed two sets of warnings, internal and external, if the driver exits the vehicle with the transmission not in Park. The alerts would reach sound levels of at least 85 dBa between 500-3000 Hz, and the external alert would sound for a full minute. The agency borrowed this warning requirement from an existing Platform Lift Standard.

Manufacturers, in particular, hated NHTSA’s proposals for audible warnings, fearing them too loud and annoying. The Alliance of Automobile Manufacturers argued that the agency did not have enough hard data on which to base the proposed regulation. (Read the comments from the Alliance of Automobile Manufacturers)

Safety Research & Strategies and other advocates also criticized the proposal because the agency had failed to base its warning recommendations on research showing its efficacy, and because warnings, by themselves, were insufficient. (Read SRS’ comments )

This rulemaking remains “open,” but inactive.

In 2013, the agency launched an FMVSS 114 compliance investigation into the potential rollaway hazards in 34 different 2013 and 2014 keyless ignition models among eight different manufacturers.  (Read NHTSA Opens Smart Key Compliance Probe  / And Now, the Rest of the Story on Keyless Ignition)

Automakers’ own internal surveys and customer complaints clearly show the ease with which drivers lose awareness of the engine and transmission state. At least one manufacturer, Toyota, is collecting rollaway data outright through its vehicle diagnostic system.

Starting with the MY 2013 Rav4, Toyota has installed a “Vehicle Control History” function on its models to collect and store data on vehicle and driver actions. Like an Event Data Recorder (EDR), which records pre-crash information, the VCH records non-crash vehicle and driver actions. In a 2019 technical paper, Toyota engineers described how the VCH records driver inputs, such as hard acceleration and hard braking, or when the vehicle’s dynamic systems, such as ABS or the electronic stability control system are activated. The data is useful, they said, to understand and analyze real-world dynamic events. Notably, Toyota’s hybrid models contain additional VCH data starting in at least one of its 2016 models, that is not described in its 2019 technical paper, that includes this data point: “Driver Exited Vehicle When Shift Position Wasn’t P.”

And what has Toyota done with that data? Mostly, it just gathered it, and used the vehicle-generated information – transmission not in Park, vehicle stationary, driver’s seatbelt unbuckled, driver’s door opened – to record the event in the VCH and to trigger a “Shift to P Before Exiting Vehicle” text message in the instrument cluster, along with a non-descript, low-volume tone alert. It could have just as easily used those same data points to activate the EPB to ensure the safety of those in and around the vehicle – and still collect the data – knowing that it protected its customers from a rollaway hazard.

Also of note, in 2019, Toyota announced that it would begin to counter the rollaway hazard in 2020 Model Year vehicles with e-shifters and EPBs, by installing an Automatic Park feature “designed to reduce the risk of rollaway.” It wasn’t until the following model year that eight out of a total of 35 MY 2021 Toyota/Lexus models which were equipped with either an EPB or an e-shifter received the new “Automatic Park” feature.

Rather than employ strategies that actually prevent the vehicle from rolling away, many automakers still rely on various cues, which might or might not alert the driver to a potential hazard and result in a correction: icons or visual messages on the information display screen, such as “Shift to Park,” and audible warnings, such as internal intermittent or continuous internal beeps and buzzers, and external horn chirps. Automakers are mandated by FMVSS 114 to emit an audible warning if the driver exits a vehicle with the engine off, leaving the key behind. But it does not set out any specific requirements for its volume, duration, frequency, or tone. The design and efficacy is left to the manufacturers. In addition, modern cars are now a cacophony of beeps and dings for all kinds of conditions – many sound alike, or fail to convey the urgency of the condition, making it difficult for drivers to understand what the vehicle is trying to tell them. In rollaway scenarios, drivers only have a second to figure it out – manufacturers have had years.

Warnings are considered one of the least effective methods of protection against a safety hazard — yet this is the only rollaway prevention feature in most passenger cars.

Another failed strategy is the use of “creep force” or “creep torque,” a condition in which the vehicle in drive or reverse will move once the driver has released the brake pedal. In 2003, NHTSA proposed to amend FMVSS 102 (Transmission shift position sequence, starter interlock, and transmission braking effect) by requiring creep force in hybrid vehicles in either gear as “a cue that indicates to the driver that he or she is in the correct gear, as the driver is releasing the brake and has the best chance of stopping quickly in case of a gear selection error.” (NHTSA dropped the proposal from the 2005 Final Rule.) Vehicles with conventional combustion engines and automatic transmission use creep force in this way. The thought is – no one gets out of a moving vehicle. On a flat paved surface, vehicle movement is theoretically apparent. But in some vehicles, that “creep” cue may not be present, either delayed or mitigated all together for improved vehicle efficiency. Absent this clear cue that the vehicle is not secured in Park, a driver may exit, resulting in a rollaway. And, the vehicle movement created by creep torque can be eliminated when the vehicle is on a slope with the transmission in a drive gear. In some real-world rollaway incidents, creep force kept the vehicle stationary in a sloped driveway with the engine running and the transmission in a drive gear. Absent vehicle movement and lacking any meaningful and urgent alert about the unsafe state of the vehicle, drivers can and do exit vehicles without the transmission in Park.

What’s It Going to Take?

NHTSA’s proposal to address the rollaway and carbon monoxide dangers linked to keyless ignitions has languished for a decade.

Three years ago, U.S. Senator Richard Blumenthal (D-CT) introduced the Protecting Americans from the Risks of Keyless Ignition Technology (PARK IT) Act, which would require NHTSA to amend and finalize the 2011 proposed rulemaking a rule that vehicles automatically shut off if left unattended after a period of time to prevent carbon monoxide poisoning, and a rule that sets a performance standard to prevent rollaway. With the failure to secure Republican support for the rollaway provision, the bill was re-formulated and re-named the Stop CO Poisoning Exposures (SCOPE) Act. In November 2019, Blumenthal, along with Sens. Edward Markey (D-MA) and Deb Fischer (R-NE), introduced the SCOPE Act, which would force NHTSA, within two years of its enactment, to issue a final rule to require manufacturers to install technology in each motor vehicle equipped with a keyless ignition device and an internal combustion engine to automatically shut off the motor vehicle after the motor vehicle has idled for the period determined by the NHTSA Administrator. This version of the bill did not contain the rollaway countermeasure aspect of the PARK IT Act. However, the House version of the bill continues to include both provisions. Congress may include some portion of either legislation in the proposed infrastructure bill, but its future is uncertain.

After decades of blaming the drivers for their own design failures, the industry has been inculcating itself in a new hazard analysis technique called Systems Theoretic Process Analysis (STPA) based on the incident causality model Systems-Theoretic Accident Model and Process (STAMP). It marks an important departure from the traditional hazard analyses processes, such as the Failure Modes and Effects Analysis (FMEA), which has long formed the foundation of automotive engineering design. This new approach integrates causal factors associated with new technology and elevates the role of human factors and flips the script on user error. Under STPA/STAMP, operator error is a symptom of a design flaw – not a cause; blaming users for hazardous incidents, rather than the systems designers is not an acceptable practice. Several major manufacturers, including Ford, GM, Nissan, and Toyota have presented at the Massachusetts Institute of Technology (MIT) Partnership for Systems Approaches to Safety and Security annual conference to discuss how they are applying this hazard control method to current their current designs.

Also, the SAE has established the Recommended Practice Task Force on Committee J-3187 Applying System Theoretic Process Analysis (STPA) to Automotive Applications, to educate engineers in how “STPA may be applied within a safety assessment process focusing on automotive vehicle safety-critical content.”

In the meantime, rollaways continue to injure and kill. One way or another, it’s time to end the carve-out for rollaway.

 

 

 

 

 

 

 

 

 

 

 

 

 

Two and a half years ago, U.S. Consumer Product Safety Commission staff approached the triad of off-road vehicle trade groups – the Specialty Vehicle Institute of America (SVIA), the Off-Highway Recreational Vehicle Association (ROHVA), and the Outdoor Power Equipment Institute (OPEI) – with some data and an offer: Write a voluntary standard to address fire hazards and debris intrusion. 

The data, aired before representatives of every major All-Terrain Vehicle (ATV), Recreational Off-Road Vehicle (ROV), and Utility Task Vehicle (UTV) manufacturer at the Grand Hyatt Hotel at Dallas-Fort Worth airport, included an extensive list of 408 fire-related incidents reported in some 47 recalls from 2005 to 2018. They covered defects ranging from fuel leaks, to over-heating plastic panels, to electrical short circuits, to exhaust system defects. And they revealed the serious flaws in current ROV design that create fire hazards, such as the structural integrity of the fuel tank system and fuel filters, the vulnerability of hoses carrying flammable liquids, overheating Engine Control Modules, the flammability of plastic body panels, and debris intrusion into the exhaust system.

No particular manufacturer was mentioned, but Polaris has certainly been at the top of the ROV fires Leader Board. Its 2016 RZR Recall 16-146 was, and remains, the single largest of more than 15 Polaris fire-related actions, covering some 133,000 Polaris Model Year 2013-2016 RZR 900 and RZR 1000 recreational off-highway vehicles. These models also remain among its most hazardous, responsible – at the time of the recall – for more than 160 reports of fires, 19 injuries, including second- and third-degree burns, and the death of a 15-year-old girl.

The offer was to help the industry write a voluntary standard to address fire hazards and the penetration hazard from under-carriage debris. The CPSC suggested that industry representatives form task groups by topic area to discuss improvements, study standards for better fuel tank test procedures, and consider creating surface temperature limits, as well as fire resistance and self-extinguishing requirements for electrical components.

Industry did nothing, which is why last month, the CPSC published an Advance Notice of Proposed Rulemaking to address the risk of injury associated with fire and debris-penetration. In the May 12 Federal Register Notice, the CPSC noted that SVIA, ROHVA, and OPEI had talked a lot about fire mitigation, but had never drafted a proposal. The debris penetration issue hadn’t generated so much as a conversation.

The Notice is basically a longer, more detailed version of the presentation Mechanical Engineer Han Lim of the CPSC’s Division of Mechanical Combustion Engineering, made to Honda, Polaris, Yamaha, Kawasaki, Textron and members from the OPEI in 2018. It also includes other contextual information, such as the size of the off-highway vehicle consumer market, the most current number of associated recalls – 68 between 2002 and 2019 – and the death and injury data.

A review of incidents in CPSC’s Consumer Product Safety Risk Management System from 2003 through 2020, identified 28 fatalities and 264 injuries from OHV hazards, and 6 fatalities and 20 injuries from debris-penetration OHV hazards. Using the National Electronic Injury Surveillance System (NEISS) database, “CPSC staff estimated that there were 14,200 emergency department-treated injuries from 2007 to 2019 associated with non-crash OHV fires and burn hazards,” the CPSC stated in the Notice.

It also discussed the debris penetration issue, which can occur in ROVs and UTVs with their larger undercarriage that exposes more floorboard and wheel-well surface to branches on the ground that can penetrate the vehicle compartment, impaling occupants. One of the several fatal incidents was described in the ANPRM: “Consumer drove on a wooded trail (dirt road) with various debris (rocks and limbs); tree limb pierced fender and nylon mesh door and impaled the driver.” The CPSC identified four debris penetration deaths and three injuries in incidents involving reduced visibility, but during normal, foreseeable use.  

Spinning Wheels

When CPSC’s Directorate of Engineering Sciences Caroleene Paul met with industry honchos in September 2018, it was on the heels of a $27.25 million civil penalty levied against Polaris Industries. The Medina, Minnesota, manufacturer paid the fine to settle two charges of untimely disclosure to the CPSC that “models of RZR and Ranger recreational off-road vehicles (ROVs) contained defects that could create a substantial product hazard or that the ROVs created an unreasonable risk of serious injury or death.” The hazard in both was a risk of fire or melting components.

The CPSC ended its presentation by speculating that manufacturers already had internal standards that addressed thermal issues, and by expressing its preference that industry representatives codify them in a voluntary safety standard. The commission offered its assistance in that process. The OEMs thanked the CPSC, agreed to look over the data and get back to the agency, but set no timetable for doing so.

And here we are. And here we’ve been.

As federal agencies go, the CPSC’s rulemaking authority is pretty weak. An industry group can waste a whole lot of time fiddle-faddling around with the voluntary standards-setting process. Hell, they can spend two and a half years just thinking about maybe drafting a standard. This is one of industries’ favorite tactics to slow or stop new rules all together. The CPSC cannot pursue a mandatory standard if the industry produces (or is in the process of producing) an acceptable voluntary standard. And, under the Consumer Product Safety Act, the CPSC has to defer to whatever weak tea the industry serves.

In the universe of consumer products, off-road vehicles are like Kryptonite to the CPSC – a fictional alien mineral that can rob the federal agency of its regulatory powers. Advocates might argue that the toxic combination of a rabidly enthusiastic customer base that openly resists any attempts to make ROVs safer, and manufacturers whose interest in vehicle improvements tends to lean towards making them faster and more powerful, has effectively stymied the agency from imposing any meaningful safety requirements. One need look no further than the CPSC’s last attempt to boost the lateral stability of Off-Highway Vehicles.

UTVs and ROVs entered the market in the 1970s, evolving from single-seat dune buggy type versions in the 1970s to today’s side-by-side, multiple-passenger versions. They first caught the CPSC’s attention around 2004, just after Yamaha introduced the Rhino. The CPSC had begun to field claims and complaints about the side-by-side – some alleging design defects – along with FOIA requests from plaintiff lawyers. Thus commenced five years of wrangling with the manufacturer over the Rhino’s lateral safety. There were meetings and letters, discussions and presentations about rollovers and partial ejection injuries, product demonstrations, and testing. Yamaha blamed its reckless customers and tried to fend off a recall with a Technical Service Bulletin and an offer to retrofit any new or used 2004 to 2007 model with free doors and handholds. But, eventually there was a formal investigation and a Special Order to produce documents. In March 2009, the CPSC forced Yamaha to recall 120,000 450, 660, and 700 Model Rhino Vehicles, after investigating more than 50 incidents causing 46 driver and passenger deaths in the Rhino 450 and 660 models. More than two-thirds of the cases involved rollovers and many involved unbelted occupants.

Seven months later, the CPSC published an ANPRM to address occupant retention and containment and stability in all ROVS and UTVs. About a year earlier, the commission had approached the industry about writing a stability standard. The notion didn’t pique much interest among manufacturers, but these off-road vehicles were racking up deaths and injuries at a rate the CPSC could not afford to ignore.

According to the briefing package that CPSC staff prepared in advance of the rulemaking, of 125 incidents that involved overturning ROVs, there were 107 incidents in which it could be ascertained that a victim was ejected from the vehicle. Ninety-eight percent involved at least one victim who exited the vehicle, either partially or wholly – thrown out, falling out, jumping out, climbing out, or otherwise fully or partially exiting the vehicle. Partial ejections included victims’ arms and legs, which extended out of the vehicle during the rollover and were crushed by some part of the vehicle.

During the next seven years, the CPSC and the ROV industry argued over a standard that would address stability, handling, and occupant protection. In 2015, then-Senator Mike Pompeo (R-KS) sponsored the ROV In-Depth Examination (RIDE) Act, which directed the Consumer Product Safety Commission, the National Academy of Sciences, the National Traffic Safety Administration, and the Department of Defense to study proposed ROV handling requirements for recreational off-highway vehicles and to prohibit the adoption of any requirements until these studies were completed. It also barred the agency from mandating that ROV manufacturers provide performance and technical data to prospective purchasers. It passed the Republican Congress as a rider on the 2016 $1.1 trillion omnibus spending bill and was signed into law by President Obama in December 2015. This effectively killed any effort to write a mandatory standard.

The industry revised its voluntary standards several times. And, in late 2016, ROHVA produced a voluntary standard that appeared to satisfy the CPSC staff – but not the commissioners. They voted 3-2 to reject termination of the rulemaking. That rulemaking technically remains open, but unlikely to advance – it’s currently awaiting the commission’s formal notice of withdrawal.

So, is this ANPRM headed down the same worn path? And why now?

The Coast is Clear

It could have something to do with the departure of CPSC Commission Chair Ann Marie Buerkle. A former Republican Congresswoman from upstate New York, Buerkle was a solid anti-consumer member of the CPSC from 2013 to 2019, and Acting Chair from February 2017 through September 2019. She was nominated by President Trump three times to be permanent Chairman, but the U.S. Senate failed to advance her nomination after key Commerce Committee members opposed her anti-regulatory, anti-consumer positions. During her tenure as agency lead, Buerkle managed to do a fine job not regulating the manufacturers of consumer products, dropping misconduct fines, voluntary recalls, and investigations into dangerous products.

She ran the agency when it hid the extent of infant deaths caused by Fisher Price’s Rock ‘N Play inclined sleepers. In May 2018, the CPSC issued a vague warning to parents urging them to always use restraints with inclined sleep products and to stop using them as soon as the baby can roll over. The alert acknowledged that the CPSC was aware of infant deaths associated with inclined sleep products, but didn’t name any particular manufacturer. Nearly a year later, on April 5, the CPSC issued another warning – this time with Fisher Price acknowledging 10 deaths in a Rock ‘N Play sleeper since 2015. On April 8, Consumer Reports published a story revealing 32 deaths linked to the product. On April 11^th, the magazine published an update linking four infant deaths to inclined sleep products manufactured by Kids II. Eventually, Fisher-Price announced that it would recall the Rock ‘n Play.

Buerkle was also instrumental in an agency decision to not force a recall of a Britax jogging stroller that injured nearly 100 users when the front wheels fell off. Instead, the CPSC entered into a settlement with Britax that ended a CPSC lawsuit to compel a recall and allowed it to forgo a recall.

The Polaris consent agreement was brokered under her stewardship, too. Unredacted nuggets of information SRS unearthed after a protracted FOIA battle for the files associated with Recall 16-146 showed that CPSC staff had been seriously alarmed by the many defects creating serious fire risks in Polaris ROVs, and had questioned the efficacy of Polaris’ fixes, with one person even urging they consider buying-back the Turbo model from customers. Yet, Buerkle appeared to have quashed recommendations for further actions against Polaris.

She finally announced her retirement after the Senate blocked her confirmation for another seven-year stint.

So perhaps, it’s safe to regulate and enforce again.

Former West Virginia Secretary of State and well-known plaintiffs’ attorney Edgar “Hike” Heiskell III died yesterday after a brief battle with cancer. He was 76 years old.

A true Renaissance man, Heiskell succeeded in politics and the law. His interests ranged from cooking to writing to an enduring love for pre-GM Swedish Saabs. A graduate of the University of West Virginia and the University of Virginia School of Law, Heiskell also served as a fighter pilot for the U.S. Air Force and Air National Guard.  From 1973-1975, he served as Secretary of State, and as the Republican State Chair from 1987 to 1990.

In legal circles, Heiskell was known as a skilled attorney willing to take on difficult defect cases, win significant settlements and verdicts, and push the National Highway Traffic Safety Administration to take action. Ryan Heiskell, also an attorney, said of his father: "He was a hero and champion for injured victims of dangerous auto defects. He literally devoted his career to helping and never backed down from a fight."

In the late 1980s and early 1990s, Heiskell tackled the stability defects in the Ford Bronco II. The compact, two-door Sport Utility Vehicle had one of the worst rollover records among the iterations of the SUV – the Insurance Institute on Highway Safety found that its rollover rate was several times its peers, one in 500 Broncos produced involved in a fatal rollover crash, and Geico stopped writing insurance policies for the vehicle.

NHTSA investigated the defect in 1989, but closed the investigation after an analysis of crash data showed that its rollover rate was comparable to other SUVs. Heiskell’s litigation work uncovered pre-production tests never disclosed to the agency, showing that the Bronco II could rollover at speeds as low as 25 mph in foreseeable accident-avoidance or lane change maneuvers. This discovery led Heiskell in 1996 to petition NHTSA to re-open the investigation and sanction Ford for failing to submit these documents in response to NHTSA’s requests for information.

The agency declined to do either. However, NHTSA issued a rare letter of admonishment to Ford. The agency expressed surprise that Ford Automotive Safety Office officials Robert B. Munson and Wayne Kippola admitted in depositions that the company only submitted materials relevant to production vehicles, despite the plain meaning of the agency’s request to supply all relevant documents. In a May 1998 letter to Ford, the agency wrote:

"We have recently requested that Ford construe ODI’ information requests according to their “plain-meaning,” and that, when a request calls for the submission of “all documents” without qualification, Ford supply all relevant documents, likewise without  qualification. If this includes information related to pre-production vehicles that, in Ford's view, differed significantly from the eventual production version of the vehicle, Ford may seek to limit the scope of the request by explaining the differences between the pre-production and the production vehicles and setting forth reasons why the information related to pre-production vehicles would not be relevant to ODI’s investigation and thus should not be required to be submitted."

"His work on unintended acceleration was also legendary,” says SRS president Sean Kane, who worked with Heiskell on many safety issues. “Those types of issues are notoriously difficult and often don’t end in good results for clients. But, Hike broke through the driver error blame game that companies foisted on victims and identified key vehicle defects. He was able to get verdicts in unintended acceleration cases — a rare feat — and he developed a lot of important markers in the playbook on how to deal with these complex cases. At the root of it, he was a caring person who used his skills to help people who often had nowhere else to turn.”